Planning security for your federated environment

To ensure that your federated environment is secure, plan the security aspects for your topology before you install Process Federation Server and federated systems.

Note: Process Federation Server is not available in IBM® Business Automation Workflow Express.

User authentication

A common user registry is required for Process Portal, Process Federation Server, and the business process management systems, so that authenticated users can access the entire environment. Supported user registries include LDAP and custom user registry. In development and test environments, you can also use a file-based basic registry.

To provide Process Portal users access to all the systems across the federated environment, configure single sign-on (SSO). SSO ensures that users can access Process Federation Server and federated systems through their browsers. It also ensures that requests that are forwarded from Process Federation Server to federated systems are authorized. A typical SSO solution uses cookies that are saved in the user's browser after the initial login. For the cookies to be accepted by all the systems, the domain names across the federated environment must be the same. For example, in your federated environment, Process Portal is available at portal.mycompany.com, Process Federation Server at pfs.mycompany.com, and the federated systems at bpm1.mycompany.com and bpm2.mycompany.com. In both quick-start and production environments, browser clients must use the full domain name to access any system in the federated environment. For example, to access Process Portal, browser clients must use portal.mycompany.com.

Secured communications

Communications are secured with Secure Sockets Layer (SSL) protocol. The SSL protocol provides transport-layer security that includes authenticity, data signing, and data encryption to ensure secure communication between a client and server. In a federated environment, a component can act as a server to one component, and as a client to another component.

IBM Business Automation Workflow V 18.0.0.2From IBM Business Automation Workflow 18.0.0.2, as an alternative to the default implementation of Process Federation Server with an embedded Elasticsearch 1.7.2 node, you can use a remote Elasticsearch 6.x cluster. If you choose to work with a remote Elasticsearch cluster, you can also use SSL to secure communications between Process Federation Server and the external cluster. In this case, you must also import the certificates of the Elasticsearch nodes into the Process Federation Server trustore.

SSL is managed through digital certificates. Each server maintains a signed digital certificate in a keystore, and each client must have a corresponding signer certificate in a truststore. Because a component can be both a server and a client, pay close attention to client and server relationships when you configure SSL for your federated environment.
Secured communications in a quick-start environment
The following figure shows how to secure communication in a development or test environment.
Figure 1. Quick-start environment
The figure shows the components of a quick-start federated environment; client application, the server that hosts the application, Process Federation Server, and the IBM BPM system.
Client communication with each of the servers is secured with SSL. The client must accept all certificates from the servers it communicates with.

Of the servers that are shown in Figure 1, only Process Federation Server has a configured truststore for the communication with the business process management systems through their REST services. Because SSL is optional for REST services, you can therefore eliminate all server-side SSL for development environments that do not require security. To simplify security configuration in a quick start development environment, configure Process Federation Server to connect to the REST services through the HTTP port on the business process management system instead of the secured HTTPS port.

Secured communications in a fully secured production environment
The following figure shows where keystore and truststore certificates must be installed for secured communications in a production environment.
Figure 2. Production environment
The figure shows the components of a production federated environment; client application, the server that hosts the application, Process Federation Server, and the IBM BPM system. All components, other than the client application, have an IBM HTTP Server in front of them.
Client communication with each of the servers is secured with SSL by default. The client must accept all certificates from the HTTP Servers it communicates with.

For secure server-to-server communication, configure SSL between each component. Each component that acts as a client to another component must have a signer certificate in a truststore. You therefore need to have an overall plan for signer certificates. For example, configure all the servers to use certificates that are signed by a certificate authority (CA). The CA can be a third-party CA, or a CA that is internal to your organization. You then have a single common signer certificate that you can import into each truststore.

Secured client application communication
A browser that displays Process Portal (or a custom client application) must have the following signer certificates:
  • If the browser connects directly to the federated environment, a signer certificate for each of the process federation servers and federated systems that it communicates with.
  • If the browser connects to the federated environment through IBM HTTP Server, a signer certificate for each of the IBM HTTP Servers.
To increase security and simplify configuration, use certificate authority (CA) signed certificates that are trusted by the users' browsers for all the components in your federated environment.

If CA-signed certificates are not used, for example, in a development or test environment, users must import signer certificates into their browsers before they use Process Portal in the federated environment. The signer certificate can be manually imported into the browser. Alternatively, the user can go to the URL for each component in the federated environment that Process Portal communicates with, and accept the certificate when prompted.

For information about the configuration paths for quick-start and production environments, see Roadmap: Configuring Process Federation Server and federated environments.

Cross-origin resource sharing (CORS)

The browser that displays Process Portal or the custom client application makes requests to Process Federation Server and federated systems. Because the requested services are not on the system that originated Process Portal or the custom client application, the federated components use CORS to enable the browser to trust the cross-origin requests. You must therefore configure a list of allowed origins for Process Federation Server and the federated systems. The allowed origin is the web server that hosts Process Portal or the custom client. For more information, see Configuring allowed origins for Process Portal .